<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->


<!DOCTYPE html
  PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-us" xml:lang="en-us">
<head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="DC.Type" content="topic">
<meta name="DC.Title" content="Step 2: (Optional) Generating and Obtaining a Certificate">
<meta name="product" content="">
<meta name="DC.Relation" scheme="URI" content="hive_00012.html">
<meta name="prodname" content="">
<meta name="version" content="">
<meta name="brand" content="30-OceanProtect Appliance 1.5.0-1.6.0 Help Center">
<meta name="DC.Publisher" content="20241029">
<meta name="prodname" content="csbs">
<meta name="documenttype" content="usermanual">
<meta name="DC.Format" content="XHTML">
<meta name="DC.Identifier" content="hive_00015">
<meta name="DC.Language" content="en-us">
<link rel="stylesheet" type="text/css" href="public_sys-resources/commonltr.css">
<title>Step 2: (Optional) Generating and Obtaining a Certificate</title>
</head>
<body style="clear:both; padding-left:10px; padding-top:5px; padding-right:5px; padding-bottom:5px"><a name="hive_00015"></a><a name="hive_00015"></a>

<h1 class="topictitle1">Step 2: (Optional) Generating and Obtaining a Certificate</h1>
<div><p>If the big data platform is Cloudera CDH, you can import the Cloudera CDH certificate to the <span>OceanProtect</span> for secure communication between the <span>OceanProtect</span> and Cloudera CDH. This section describes how to generate and obtain a certificate on Cloudera CDH. Skip this section in other scenarios. The following uses Cloudera CDH 6.3 as an example. The operations vary depending on the version. For details, see the corresponding version of product documentation of the big data platform.</p>
<div class="section"><h4 class="sectiontitle">Procedure</h4><ol><li id="hive_00015__li5631235132010"><a name="hive_00015__li5631235132010"></a><a name="li5631235132010"></a><span>Use PuTTY to log in to any node in the big data cluster.</span></li><li id="hive_00015__li19992695227"><a name="hive_00015__li19992695227"></a><a name="li19992695227"></a><span>Check whether TLS/SSL has been configured on the Cloudera CDH platform. Run the following commands to create a certificate storage path.</span><p><ul><li>If TLS/SSL has not been configured, run the following command to create a certificate storage path and perform <a href="#hive_00015__li6528173201712">3</a> to <a href="#hive_00015__li26041510201017">12</a>:<pre class="screen">mkdir -p /opt/cloudera/security/pki</pre>
</li><li>If TLS/SSL has been configured:<ul><li>If you do not need to regenerate or configure a certificate, obtain related files and passwords from the environment administrator.</li><li>If you need to regenerate and configure a certificate, perform the following steps to back up related files and perform <a href="#hive_00015__li6528173201712">3</a> to <a href="#hive_00015__li26041510201017">12</a>.<ol type="a"><li>Obtain the <span class="parmname"><b>hive.server2.keystore.path</b></span> configuration path and back up all files in the path. The following uses the configuration of <a href="#hive_00015__li19992695227">2</a> as an example:<pre class="screen">mkdir -p /opt/cloudera/security/pki_bak; 
cp -r /opt/cloudera/security/pki/* /opt/cloudera/security/pki_bak</pre>
</li><li>Obtain the <span class="parmname"><b>HiveServer2 TLS/SSL Client Trust Store File</b></span> configuration path and back up all files in the path. The following uses the configuration of <a href="#hive_00015__li19992695227">2</a> as an example:<pre class="screen">mkdir -p $JAVA_HOME/jre/lib/security_bak; 
cp -r $JAVA_HOME/jre/lib/security/* $JAVA_HOME/jre/lib/security_bak</pre>
</li></ol>
</li></ul>
</li></ul>
</p></li><li id="hive_00015__li6528173201712"><a name="hive_00015__li6528173201712"></a><a name="li6528173201712"></a><span>Run the following command to go to the corresponding directory:</span><p><pre class="screen">cd /opt/cloudera/security/pki</pre>
</p></li><li id="hive_00015__li15931291246"><a name="hive_00015__li15931291246"></a><a name="li15931291246"></a><span>Run the following command to generate the JKS certificate:</span><p><div class="p">During the command execution, set the keystore password. The generated JKS certificate is stored in the <span class="uicontrol"><b>/opt/cloudera/security/pki</b></span> directory on the current node.<pre class="screen">$JAVA_HOME/bin/keytool -genkeypair -alias $(hostname -f) -keyalg RSA -keystore /opt/cloudera/security/pki/$(hostname -f).jks -keysize 2048 -dname "CN=$(hostname -f),OU=Engineering,O=Cloudera,L=Palo Alto,ST=California,C=US" -ext san=dns:$(hostname -f)</pre>
</div>
<p><span><img src="en-us_image_0000001792361546.png"></span></p>
</p></li><li><span>Run the following command to generate the CSR certificate:</span><p><pre class="screen">$JAVA_HOME/bin/keytool -certreq -alias $(hostname -f) -keystore /opt/cloudera/security/pki/$(hostname -f).jks -file /opt/cloudera/security/pki/$(hostname -f).csr -ext san=dns:$(hostname -f) -ext EKU=serverAuth,clientAuth</pre>
<p><span><img src="en-us_image_0000001792521290.png"></span></p>
</p></li><li><span>Run the following commands in sequence to generate the PEM certificate:</span><p><pre class="screen">keytool -export -alias $(hostname -f) -keystore $(hostname -f).jks -file server.cer</pre>
<pre class="screen">openssl x509 -inform DER -outform PEM -text -in server.cer -out server.pem</pre>
<p><span><img src="en-us_image_0000001839240597.png"></span></p>
</p></li><li><span>Run the following command to verify the certificate.</span><p><pre class="screen">openssl x509 -in /opt/cloudera/security/pki/server.pem -noout -text</pre>
</p></li><li><span>Run the following commands to add the keystore password to the Java security library:</span><p><pre class="screen">sudo cp $JAVA_HOME/jre/lib/security/cacerts $JAVA_HOME/jre/lib/security/jssecacerts</pre>
<pre class="screen">$JAVA_HOME/bin/keytool -storepasswd -keystore $JAVA_HOME/jre/lib/security/cacerts</pre>
<pre class="screen">$JAVA_HOME/bin/keytool -storepasswd -keystore $JAVA_HOME/jre/lib/security/jssecacerts</pre>
<p>The initial password is <span class="uicontrol"><b>changeit</b></span>. Change the password to the password set in <a href="#hive_00015__li15931291246">4</a> as prompted.</p>
</p></li><li><span>Run the following commands to add the certificate to the Java security library:</span><p><pre class="screen">sudo $JAVA_HOME/bin/keytool -importcert -alias $(hostname -f) -keystore</pre>
<pre class="screen">$JAVA_HOME/jre/lib/security/jssecacerts -file /opt/cloudera/security/pki/server.pem</pre>
<p><span><img src="en-us_image_0000001792361542.png"></span></p>
</p></li><li id="hive_00015__li11362958912"><a name="hive_00015__li11362958912"></a><a name="li11362958912"></a><span>Run the following commands in sequence to create a soft link from the cluster node to the certificate:</span><p><pre class="screen">sudo ln -s /opt/cloudera/security/pki/$(hostname -f).pem /opt/cloudera/security/pki/agent.pem</pre>
<pre class="screen">sudo ln -s /opt/cloudera/security/pki/$(hostname -f).jks /opt/cloudera/security/pki/server.jks</pre>
</p></li><li><span>Log in to other Hive cluster nodes one by one and repeat the executions from <a href="#hive_00015__li5631235132010">1</a> to <a href="#hive_00015__li11362958912">10</a>.</span></li><li id="hive_00015__li26041510201017"><a name="hive_00015__li26041510201017"></a><a name="li26041510201017"></a><span>Use a browser to log in to Cloudera Manager and modify the Hive cluster configuration.</span><p><ol type="a"><li>Choose <span class="uicontrol"><b>Cluster &gt; Hive &gt; Configuration</b></span>.</li><li>Click <span class="uicontrol"><b>Hive (Service-Wide)</b></span> and <span class="uicontrol"><b>Security</b></span> in sequence, and set the following parameters: <a href="#hive_00015__fig1519418412433">Figure 1</a> shows a configuration example.<ul><li>Select <span class="uicontrol"><b>Hive (Service-Wide)</b></span>.</li><li>Set <span class="parmname"><b>hive.server2.keystore.path</b></span> to <span class="parmvalue"><b>/opt/cloudera/security/pki/server.jks</b></span>.</li><li>Set <span class="parmname"><b>hive.server2.keystore.password</b></span> to the password set in <a href="#hive_00015__li15931291246">4</a>.</li><li>Set the <span class="parmname"><b>HiveServer2 TLS/SSL Client Trust Store File</b></span> to <span class="parmvalue"><b>/usr/java/jdk1.8.0_171/jre/lib/security/jssecacerts</b></span>, where <span class="parmvalue"><b>jdk1.8.0_171</b></span> is the Java version. Replace it with the actual Java version number.</li></ul>
<div class="fignone" id="hive_00015__fig1519418412433"><a name="hive_00015__fig1519418412433"></a><a name="fig1519418412433"></a><span class="figcap"><b>Figure 1 </b>Hive cluster configuration</span><br><span><img src="en-us_image_0000001839240601.png"></span></div>
</li><li>On the Cloudera Manager home page, click <span class="uicontrol"><b>Cloudera Manager Service</b></span>.</li><li>Choose <span class="uicontrol"><b>Configuration &gt; Security</b></span> and set the following parameters: <a href="#hive_00015__fig1519418412433">Figure 1</a> shows a configuration example.<ul><li>Set <span class="parmname"><b>ssl.client.truststore.location</b></span> to <span class="parmvalue"><b>/usr/java/jdk1.8.0_171/jre/lib/security/jssecacerts</b></span>. <span class="parmvalue"><b>jdk1.8.0_171</b></span> is the Java version number, which should be changed based on the site requirements.</li><li>Set <span class="parmname"><b>ssl.client.truststore.password</b></span> to the password set in <a href="#hive_00015__li15931291246">4</a>.<p><span><img src="en-us_image_0000001839160649.png"></span></p>
</li></ul>
</li><li>On the <span class="uicontrol"><b>Instances</b></span> page, synchronize the preceding configurations to each cluster node.</li><li>Log in to the management node of the Hive cluster by using PuTTY and run the following command to restart the management service:<pre class="screen">sudo systemctl restart cloudera-scm-server</pre>
</li><li>Use a browser to log in to Cloudera Manager and restart the cluster and management service.<ol class="substepthirdol"><li>Choose <span class="uicontrol"><b>Clusters &gt; Hive</b></span> and restart the Hive cluster in the <span class="uicontrol"><b>Actions</b></span> column.</li><li>On the home page, choose <span class="uicontrol"><b>Cloudera Management Service</b></span> and restart the management service in the <span class="uicontrol"><b>Actions</b></span> column.</li></ol>
</li><li>If the Hive cluster contains multiple nodes, you need to combine the JKS files generated on all nodes into one JKS file. Otherwise, skip this step.<ol class="substepthirdol"><li>Copy the JKS files in the <span class="uicontrol"><b>/opt/cloudera/security/pki</b></span> directory on all nodes to the directory on the same node.</li><li>Go to the <span class="uicontrol"><b>/opt/cloudera/security/pki</b></span> directory and run the following command to combine the JKS files generated on all nodes into one certificate:<div class="p">The following command is used to merge certificate 2 to certificate 1. If there are multiple nodes, run the following command to merge all certificates to the same certificate:<pre class="screen">keytool -importkeystore -srckeystore <em>certificate 1</em>.jks -destkeysore <em>certificate 2</em>.jks</pre>
</div>
<p></p>
</li></ol>
</li></ol>
</p></li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="hive_00012.html">Backing Up Hive Backup Sets</a></div>
</div>
</div>

<div class="hrcopyright"><hr size="2"></div><div class="hwcopyright">Copyright &copy; Huawei Technologies Co., Ltd.</div></body>
</html>